Vim Vulnerability: Buffer Overflow Due to ASCII NUL Characters in Search Patterns
Summary
DEBIAN-CVE-2024-43790: Vim is an open source command line text editor. Affects vim versions < 2:9.1.0698-1. Fixed in 2:9.1.0698-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility in text manipulation. It supports various modes, including insert and command modes, allowing users to perform complex editing tasks. However, a recent vulnerability has been identified that affects Vim versions prior to 2:9.1.0698-1, specifically when handling search patterns with ASCII NUL characters, leading to potential buffer overflow issues.
Vulnerability Detail
The vulnerability arises when the search-count message is disabled in Vim, and the right-left mode is enabled. When a search pattern containing ASCII NUL characters is processed, Vim allocates a new buffer for the reversed search pattern. Due to the nature of the strlen() function, which stops counting at the first ASCII NUL byte, the allocated buffer size becomes smaller than expected. This discrepancy leads to an overflow when accessing characters in the message buffer, potentially allowing for arbitrary code execution or crashes.
How To Fix
Minimum fixed version
2:9.1.0698-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using search patterns that contain ASCII NUL characters or disable the right-left mode by executing ':set norl' in Vim.
Conclusion
In summary, the identified vulnerability in Vim poses a significant risk due to improper handling of search patterns with ASCII NUL characters. Users are advised to update to the latest patched version to mitigate this risk and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for vim →
FAQ
The vulnerability is a buffer overflow caused by improper handling of search patterns containing ASCII NUL characters when right-left mode is enabled.
You can check your Vim version by running 'vim --version' in the terminal. If it is below 2:9.1.0698-1, it is affected.
Exploiting this vulnerability could lead to arbitrary code execution, crashes, or data corruption, posing significant risks to system integrity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
